Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ARIN Public Incident Report – 4.10 Misissuance Error

arin.net

Post reply on HN
Print view View original

21–30 of 41 posts

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#21

Post by teraflop »

Titan2189 wrote: post #19
galaxygate wrote: post #14

Affected customer here, if you're curious on our original NANOG post on the whole situation: Hey NANOG, After receiving a BGPAlerter notification that one of our subnets (23.150.164.0/24) had been hijacked, I checked and noticed the prefix in question was missing RPKI. Assuming I had fat fingered something and butchered the ROA, I logged into ARIN and found that the prefix was missing from our resource list entirely,…

The original report says > The incorrect state persisted for approximately seven days before detection However you're saying you've reached out "within a few minutes" ?

The "incorrect state" being talked about is the IP prefix being misregistered in ARIN's database.

The "hijacking" happened later, when the IP prefix was announced via BGP by the registrant who it was incorrectly assigned to. Those are two different events.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#22

Post by jonathanlydall »

stefan_ wrote: post #8
progbits wrote: post #3

I like how frank the report is, no sugarcoating. "We relied on manual error prone verification and made a mistake. We have to automate the process." As ARIN block owner this situation is kinda scary but reading this actually makes me think it's less likely to happen again .

I'm curious how these fellas took something like IP block allocation and turned it into an Excel based workflow.

“Workflow” is probably a bit generous to describe how they probably use Excel.

Having worked at a mom and pop ISP a couple of decades ago where we used Excel to track a lot of things, I can see how this might have happened.

To actually know who is allocated what is ultimately just a list.

And when there are only a few people who edit the list (and probably no more than 1 person at a time) you can get by with even a plain text file, but Excel is quite a bit nicer as you can do things like filtering and sorting easily, maybe even some formulas to help with things.

Building a program backed by a database might be nice, but hard to justify when the manual system has never been a problem before.

They’ve probably been thinking for a while they should, but it’s just never been enough of a pain point for them to invest the effort.

Looks like they see this incident as justification that they need a system with hard coded rules and constraints, no more manual checking.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#23

Post by AndroTux »

thaumaturgy wrote: post #16
galaxygate wrote: post #14

Affected customer here, if you're curious on our original NANOG post on the whole situation: Hey NANOG, After receiving a BGPAlerter notification that one of our subnets (23.150.164.0/24) had been hijacked, I checked and noticed the prefix in question was missing RPKI. Assuming I had fat fingered something and butchered the ROA, I logged into ARIN and found that the prefix was missing from our resource list entirely,…

[flagged]

Maybe some college of theirs on HN recognized the story and shared it with them.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#24

Post by nateb2022 »

thaumaturgy wrote: post #16
galaxygate wrote: post #14

Affected customer here, if you're curious on our original NANOG post on the whole situation: Hey NANOG, After receiving a BGPAlerter notification that one of our subnets (23.150.164.0/24) had been hijacked, I checked and noticed the prefix in question was missing RPKI. Assuming I had fat fingered something and butchered the ROA, I logged into ARIN and found that the prefix was missing from our resource list entirely,…

[flagged]

> Unless you've got a regular HN account and just set up a new business-facing one for this?

This is likely; I can't imagine a regular HN user would appreciate having their subnet publicly available in their comment history.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#25

Post by rmoriz »

rmoriz wrote: post #4
gbil wrote: post #2

A couple of years ago ARIN increased their fees considerably - way higher than fees paid to RIPE for way less resources - and had a call with their management to express my frustration, not because I was paying from my pocket but because of the high discrepancy of the what they wanted to get and the quantity/quality of their services. Now I can see that their backbone services haven't really improved while their inco…

Now ARIN is much cheaper than RIPE for small entities.

fee schedules FYI

- ARIN 2026 PDF: https://www.arin.net/resources/fees/images/2026feeschedule.p...

- RIPE 2026 : https://www.ripe.net/membership/payment/

Enthusiasts, trainees and small orgs are paying a lot more with RIPE.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#26

Post by ang_cire »

12_throw_away wrote: post #18
mlhpdx wrote: post #10

So at least a good chunk of the Internet does indeed operate on a spreadsheet. Good to know.

All data begins life in a spreadsheet and dies in a spreadsheet. Automation is an illusion; databases are illusions. Only Excel is real.

This reads like a joke, but I've known two DBAs who don't use database management tools beyond exporting whole tables to excel, making manual changes, and importing to update the tables. Scary stuff.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#27

Post by squigz »

This is a bit beyond my paygrade, but... this is as serious as it sounds, right? I'm just a bit surprised/confused by the response in these comments, especially compared to outages like when CF goes down. It's like that Gordon Ramsay meme. Is ARIN the 8 year old in this situation?

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#28

Post by icedchai »

rmoriz wrote: post #25
rmoriz wrote: post #4

Earlier quoted context omitted.

Now ARIN is much cheaper than RIPE for small entities.

fee schedules FYI - ARIN 2026 PDF: https://www.arin.net/resources/fees/images/2026feeschedule.p... - RIPE 2026 : https://www.ripe.net/membership/payment/ Enthusiasts, trainees and small orgs are paying a lot more with RIPE.

Not necessarily. Many have their RIPE registrations through an existing, “sponsoring” LIR. They’re not paying that 1800 Euro, the LIR is.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#29

Post by rmoriz »

icedchai wrote: post #28
rmoriz wrote: post #25

Earlier quoted context omitted.

fee schedules FYI - ARIN 2026 PDF: https://www.arin.net/resources/fees/images/2026feeschedule.p... - RIPE 2026 : https://www.ripe.net/membership/payment/ Enthusiasts, trainees and small orgs are paying a lot more with RIPE.

Not necessarily. Many have their RIPE registrations through an existing, “sponsoring” LIR. They’re not paying that 1800 Euro, the LIR is.

A single AS resource and a single PI assignment cost more than the ARIN fee.

Re: ARIN Public Incident Report – 4.10 Misissuance Error

#30

Post by icedchai »

rmoriz wrote: post #29
icedchai wrote: post #28

Earlier quoted context omitted.

Not necessarily. Many have their RIPE registrations through an existing, “sponsoring” LIR. They’re not paying that 1800 Euro, the LIR is.

A single AS resource and a single PI assignment cost more than the ARIN fee.

Are you sure? For RIPE I see a 50 ASN plus 75 euro PI fee. ARIN is $275. Maybe I’m looking at it wrong.

It’s cheaper as a hobbyist to use a RIPE LIR. Even in the US. That’s what I’ve been doing for years.

Post reply on HN